Ransomware groups are shifting from file encryption to data theft and extortion-only pressure. Data-theft extortion means attackers copy sensitive files and threaten to publish them unless paid, even without locking systems. Palo Alto Networks Unit 42 found encryption in only 78% of extortion cases in 2025, down from near-or-above 90% in 2021-2024 analysis of the cyber-extortion economy. Sophos found 50% of ransomware attacks resulted in encryption in 2025, down from 70% in 2024 State of Ransomware 2025 report.
Table of Contents
- How far has encryption fallen?
- Why are attackers choosing theft?
- What does a theft-first attack look like?
- How should defenses change?
How far has encryption fallen?
Unit 42 also saw intrusions move to extortion while victims kept system access. That breaks the old assumption that extortion means locked systems. Sophos called its 2025 encryption rate the lowest in six years of its study.
GuidePoint Security's GRIT team also reports growth in extortion-only attacks that bypass encryption for theft. In manufacturing, defenders stopped more attempts before encryption. Attackers answered by stealing data and using extortion-only pressure to keep leverage.
Why are attackers choosing theft?
S-RM finds some attackers now go straight to sensitive data. They use threats to publish that data as their main leverage.
That approach cuts attacker cost and avoids the complexity of deploying encryption. It also keeps pressure on victims who blocked or recovered from encryption.
What does a theft-first attack look like?
Gunra is a Conti-derived ransomware-as-a-service operation that emerged in April 2025, according to six agencies in a CISA advisory CISA advisory AA26-222A. It steals business data, PII and email before encrypting, with one victim losing tens of terabytes.
Gunra has hit government, healthcare, financial services and critical infrastructure across five regions. Initial access came through flaws in internet-facing VPNs and firewalls.
How should defenses change?
Part of the encryption drop reflects earlier interception, according to Sophos. Mandiant finds operators now target backups, identity services and virtualization planes in its 2026 trends review Mandiant M-Trends 2026 summary. Backups alone no longer stop extortion when stolen data is the leverage.
Defenders must also block exfiltration. Treat confirmed theft as a breach and extortion risk, even without locked files. Start notification and containment based on what left the network, not what was encrypted.
- Patch internet-facing VPNs and firewalls quickly.
- Isolate backups, identity systems and virtualization controls from routine access.
- Alert on large or unusual outbound transfers, even when systems run normally.
You Might Also Like
- Teen Ransomware Suspect Allegedly Led Gang Behind Hundreds of Attacks
- Ransomware Negotiation Response Checklist: Passwords, Accounts, and Credit
- Ransomware Fraudster Who Targeted Victims Appears in US Court